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Amendments to the Specification 

Replace the paragraph starting on page 4 at line 2 with the following: 
Fig. 6 is a block diagram of a second embodiment of a server [[2]] 40; 

Replace the paragraph starting on page 4 at line 4 with the following: 
Fig. 7 is a block diagram of a third embodiment of a server [[2]] 40; 

Replace the paragraph starting on page 4 at line 6 with the following: 
Fig. 8 is a block diagram of a fourth embodiment of a server [[2]] 40 ; 

Replace the paragraph starting on page 5 at line 4 with the following: 
Fig. 2 is a block diagram of a first embodiment of an intrusion preventing system, where 
a regular region 41 and a decoy region 42 are secured in different storage regions on one server 
[[4]] 40. The regular region 41 and the decoy region 42 serves as the regular data storage means 
[[2]] 3 and the decoy data storage means [[3]] 4^ which are controlled with the same IP address. 
A converting section 44 serves as the guiding means 2. 

Replace the paragraph starting on page 5 at line 12 with the following: 
A network interface 46 controls a physical cormection between the server [[4]] 40 and the 
communication network 1. A TCP/IP section 45 executes a communication protocol on the basis 
of TCP/IP. When a password is set, an intrusion monitoring section 47 determines an access 
where the number of erroneously input passwords exceeds a predetermined value, an access 
which has performed a port scan, and the like as an access which has been illegally performed by 
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an intruder. The monitor results are notified to the converting section 44. The converting section 
44 includes a destination revolting section 44 which rewrites a destination of an access command 
and a response rewriting section 442 which rewrites the content of a response command. The 
destination rewriting section 441 writes the destination of access command which has been 
determined as an illegal access by the monitoring section 47 to the decoy region 42. The 
response rewriting section 442 will be described latt e r later . 

Replace the paragraph starting on page 8 at line 25 with the following: 
In the above embodiment, the case that the converting section 44 and the monitoring 
section 47 are provided in the server [[4]] 40 has been explained. As shown in Fig. 5, however, 
these sections 44 and 47 may be provided in an dedicated server [[4A]] 40A different from the 
server [[4]] 40. Regarding the access command from the intruder, its content is converted in a 
converting section 44 in the dedicated server [[4A]] 40A and access is conducted to the decoy 
region 42 in the server [[4]] 40. The converting section 44 and the monitoring section 47 may 
individually be connected between the communication network 1 and the server [[4]] 40. 

Replace the paragraph starting on page 10 at line 17 with the following: 
In each of the above embodiments, such a configuration has been employed that the 
monitoring section 47 (the first embodiment), the access target monitoring section 48 (the second 
embodiment), or the program monitoring section 49 (the third embodiment) is provided so as to 
judge the contents of an access command and a determination is made on the basis of the 
judgment results whether or not the access command should be rewritten. In this invention, such 
a configuration can be employed that all access commands whose IP addresses are the server 
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[[4]] 40, namely all access commands directed to the server [[4]] 40, are rewritten such that their 
destinations are directed to the decoy region. 

Replace the paragraph starting on page 12 at line 1 1 with the following: 
FIG. 10 is a block diagram of a fifth embodiment. In the first to fourth embodiments, the 
regular region 41 and the decoy region 42 maintained in different storage regions on the same or 
one server [[4]] 40 respectively serve as the regular data storage means [[2]] 3 and the decoy data 
storage means [[3]] 4 shovm in FIG. 1, and the server [[4]] 40 also functions as the guiding 
means 2. 

Replace the paragraph starting on page 12 at line 18 with the following: 

In the fifth embodiment, a regular server 6 and a decoy server 7 provided together with 

the regular server 6 fimctions as the regular data storage means [[2]] 3 and the decoy data storage 

means [[3]] 4. A router 8 functions as the guiding means 2. 
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